Lie Ryan
  • Member for 10 years, 7 months
  • Last seen this week
How am I ever going to be able to "vet" 120,000+ lines of Composer PHP code not written by me?
140 votes

You can't vet individual lines of code. You'll just die trying to do that. At some point, you have to trust someone else. In 1984, Ken Thompson, one of the co-inventors of much of Unix, wrote a short ...

View answer
Why would a school need to install certificates on student laptops?
112 votes

There are two different kinds of certificates you could install on a machine: The first type of certificate is root certificate authority. A root certificate contains just a public key of the ...

View answer
How to prevent a hosting company from accessing a VM's encryption keys?
109 votes

You can't, plain and simple. If you don't trust the hosting company, you don't host with them. This is law #3 from 10 immutable law of security: Law #3: If a bad guy has unrestricted physical ...

View answer
If we should encrypt the message rather than the method of transfer, why do we care about wifi security? Is this just security theatre?
Accepted answer
99 votes

Network encryption protects against different set of threats than application layer encryption like TLS. In particular, network encryption like Wifi encryption are primarily designed to protect from ...

View answer
Why would a password be hashed before being used to encrypt something?
Accepted answer
97 votes

It sounds like a primitive version of a key derivation function (KDF), in particular they probably could have avoided reinventing the wheel by using PBKDF2. There are several reasons why you don't ...

View answer
Why use HTTPS Everywhere when we have HSTS supported browsers?
93 votes

HSTS uses a Trust on First Use model. If your first connection to the site was already compromised, you may not receive an HSTS error on subsequent requests. The HTTPS Everywhere plugs this hole, by ...

View answer
What makes Docker more secure than VMs or bare metal?
81 votes

Saying either a VM or Docker is more secure than the other is a massive over simplification. VM provides hardware virtualization; the hypervisor emulates hardware so that the guest kernel thinks it ...

View answer
Are there security advantages gained from forcing a website to be available from just one tab at a time?
79 votes

Generally, no, it's not reasonable to force users to a single tab. There are no technical security reasons for making a website available to a single tab only. This is generally common just due to ...

View answer
How do living politicians protect their readily obtainable signatures from misuse?
77 votes

They don't. Outside the lowest security scenarios, signatures aren't intended to be security feature to prevent forgery. In most cases, putting a signature on paper is just ceremonial. The actual ...

View answer
How can I securely develop a local webapp at a coffee shop?
Accepted answer
74 votes

Safely developing against localhost can be done provided: your machine is configured to resolve localhost to a loopback address (note, it's possible to change your hosts file to resolve localhost to ...

View answer
Does HTTP redirect to HTTPS automatically?
59 votes

No, at the moment no major browsers would redirect to HTTPS automatically. The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or ...

View answer
Does injecting querystring values directly into HTML pose a security risk?
Accepted answer
57 votes

Plaintext injection is an issue. Say you have a page template that looks like this: Hi <name>, Blah blah blah. And you can inject from the URL. An attacker can construct an email with a ...

View answer
Are there joint password accounts? (Like bank accounts)
55 votes

It's generally undesirable to have multiple people knowing the same password. Instead, systems that requires multiple user to be able to access the same resources usually requires each user to create ...

View answer
How does a SIM card prevent cloning?
Accepted answer
55 votes

The SIM card contains a private key or more commonly a symmetric key called the "Ki", and the card is designed to never divulge this key to the outside world. The SIM card itself has physical security ...

View answer
Why is end-to-end encryption still not default in mails?
Accepted answer
53 votes

It's not that hard, why isn't it standard for years? Because that would not have solved the problem that PGP is trying to solve. PGP is an end to end encryption, so if there is any way for the ...

View answer
Is 2FA via mobile phone still a good idea when phones are the most exposed device?
52 votes

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...

View answer
What is the idea of passwords with random buttons position
Accepted answer
52 votes

Using a randomized software keyboard for password input is based on the misconception that it can prevent key loggers. It can somewhat effectively prevent hardware key logger from capturing the login ...

View answer
Why is it more secure to use intermediate CA certificates?
Accepted answer
38 votes

Yes, the number of compromised certificates are much larger with Root Certificate compromise. But it's not just the number certificates. Getting a new root certificates deployed due to compromised ...

View answer
Where do you store your personal private GPG key?
38 votes

This is not what I currently use, but I am thinking about it: Encrypt the private key with very long symmetric encryption key Use Shamir's Secret Sharing to split the symmetric encryption key to 7 ...

View answer
Should I let my child's school have access to my kid's personal laptop?
35 votes

Now the school IT department wants to install some software on the laptop and is asking for administrative access. The school does it because it's easy for them. Lots of parents are computer ...

View answer
Why does SSL use both asymmetric cryptography and symmetric cryptography algorithms together?
35 votes

Symmetric cryptography cannot be used for exchanging secrets between machines that had never communicated before, but asymmetric cryptography is limited to encrypting very small data (the size of the ...

View answer
Is CVV calculated or merely assigned?
Accepted answer
31 votes

CVV is calculated: [CVV Generate] verb generates a CVV that is based on the information that the PAN_data, the expiration_date, and the service_code parameters provide. This verb uses the Key-A and ...

View answer
Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?
29 votes

If you ignore the certificate warning the encryption still applied, but because it's an unauthenticated encryption, the encryption is useless against active adversary (an MITM adversary that can ...

View answer
Is it OK that a sysadmin knows the password for a newcomer / act as a user (immediately after his/her recruiting)?
29 votes

In a small company, it is likely that the administrator that sets up a new employee's machine is also the administrator of the company emails and document servers. In which case, the admin is already ...

View answer
How can "USB stick" online identification possibly work?
29 votes

One way it could work is that Chrome supports FIDO U2F without plugin. Given that now Chrome is now the most popular browser and that Chrome runs on Windows, Mac, and Linux, it's not totally incorrect ...

View answer
Is strategic cyber-warfare feasible today?
27 votes

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the ...

View answer
How do US government agencies open their email attachments?
27 votes

Segmentation is the key technique here. You never work with sensitive data and external data at the same time. Depending on the sensitivity, you may use a different device that may be air gapped from ...

View answer
Is the BBC’s advice on choosing a password sensible?
27 votes

It is more secure than what most people are doing, which is to use one dictionary words. The BBC's method starts with one or two sentence, instead of just a word. However, it is less secure than what ...

View answer
Phone calls that listen to you saying hello and then say "goodbye"
27 votes

We get these too in Australia. The consensus in the Internet seems to be that these are automated calls from cold call telemarketers. These automated callers calls random numbers and wait for the call ...

View answer
Why do we trust US Certificate Authorities?
26 votes

A CA's role in the PKI is verifying identity. A CA never possess the private key of the certificate they're signing (as long as you use the standard procedure where you generate the key and CSR, ...

View answer
1
2 3 4 5
16